# FedRAMP Modernization: Transitioning from Rev5 to 20x & CR26

Canonical URL: <https://www.graduateschool.edu/courses/fedramp-modernization-rev5-to-20x-and-cr26>

## Overview

FedRAMP is going through the largest change in its history. The Consolidated Rules for 2026 become mandatory on January 1, 2027, retiring long-familiar artifacts, revising core terminology, and steering the program toward the automated, data-driven FedRAMP 20x model, with Rev5 sunsetting by the close of 2028. This intermediate course sets out what changes and on what schedule, sets Rev5 authorization against 20x certification, and works through the modernized package approach built on Security Decision Records, structured data, and Key Security Indicators.

Participants finish by drafting a workable Rev5-to-20x transition roadmap. Because the program bears on industry as much as on government, the course serves agency staff alongside the cloud service providers and contractors who have to meet the new requirements — and the live format lets both perspectives be aired in the same room.

## What you'll learn

- Explain CR26 and the FedRAMP modernization timeline running through 2028
- Set Rev5 authorization against 20x certification
- Describe the new certification classes and what changes about boundaries
- Modernize packages around Security Decision Records and structured data
- Put Key Security Indicators and automated validation to work
- Draft a Rev5-to-20x transition roadmap

## Curriculum

#### Module 1: CR26 Foundations and the FedRAMP Transition Timeline

- Examine the changes introduced by CR26 and the key milestones and dates in the FedRAMP transition timeline.

#### Module 2: From Rev5 Authorization to 20x Certification

- Explore how FedRAMP 20x shifts the program from the Rev5 authorization model toward a certification-based approach.

#### Module 3: Certification Classes, Scope, and Boundary Changes

- Review the new certification classes and evaluate how changes to system scope and authorization boundaries affect certification.

#### Module 4: Modernizing Packages with Security Decision Records and Structured Data

- Use Security Decision Records and structured data to replace or modernize traditional authorization package artifacts.

#### Module 5: Key Security Indicators and Automated Validation

- Examine Key Security Indicators and the role of continuous automated validation in demonstrating security performance.

#### Module 6: Ongoing Certification, Reporting, and Agency Collaboration

- Maintain certification through continuous reporting, evidence updates, and collaboration with participating agencies.

#### Module 7: Building a Rev5-to-20x Transition Roadmap

- Develop a practical roadmap for migrating systems, documentation, processes, and stakeholders from Rev5 to FedRAMP 20x.

#### Module 8: Developing a CR26 Transition Strategy Capstone

- Produce a comprehensive CR26 transition strategy that addresses certification scope, documentation, automation, reporting, and implementation priorities.

## Schedule
- Jan 26, 2027 – Jan 27, 2027 — Live Online
- Feb 4, 2027 – Feb 5, 2027 — Live Online
- Mar 24, 2027 – Mar 25, 2027 — Live Online
- Apr 7, 2027 – Apr 8, 2027 — Live Online
- May 3, 2027 – May 4, 2027 — Live Online
- Jun 4, 2027 – Jun 7, 2027 — Live Online
- Jul 9, 2027 – Jul 12, 2027 — Live Online

## Instructors

### Wes Bryan — Instructor

Wes Bryan resides in Gainesville, Florida, and has built his career around technology, education, and helping others understand complex subjects. He values continuous learning, clear communication, and practical problem-solving. Outside of work, Wesley enjoys running, hiking, fishing, and spending time outdoors. He also has a strong interest in music and literature, enjoys reading both fiction and nonfiction, as well as playing guitar.

### Chuck Moore — Instructor

With more than 25 years of experience in IT and cybersecurity, Chuck has built a career on a strong foundation in security, networking, help desk operations, and technical training. He has helped organizations strengthen their security posture by identifying vulnerabilities, conducting threat assessments, implementing security controls, and ensuring compliance with industry standards. Combining extensive technical expertise with a passion for education, Chuck equips professionals with the knowledge and practical skills needed to recognize risks, risks and respond effectively.

## Pricing

**Tuition:** $1049